Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity
1,243 Commits 2 Branches 291 Tags 8.2 MiB
419f1d89c2
Commit Graph

43 Commits

Author SHA1 Message Date
madaidan
97d8db3f74
Restrict sudo's file permissions 2021-06-05 19:16:42 +00:00
Patrick Schleizer
a67007f4b7
copyright 2021-03-17 09:45:21 -04:00
Patrick Schleizer
b2b614ed2a
cover more folders in /usr/local 2020-12-06 04:15:52 -05:00
Patrick Schleizer
5bd267d774
refactoring 2020-12-06 04:10:50 -05:00
Patrick Schleizer
11cdce02a0
refactoring 2020-12-06 04:10:10 -05:00
Patrick Schleizer
f73c55f16c
/opt 
https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706/68
 2020-12-06 04:08:58 -05:00
Patrick Schleizer
c031f22995
SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists 
`whitelists_disable_all=true`
 2020-12-01 05:14:48 -05:00
Patrick Schleizer
b09cc0de6a
Revert "SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists" 
This reverts commit 36a471ebce.
 2020-12-01 05:10:26 -05:00
Patrick Schleizer
704f0500ba
fix, rename 40_default_whitelist_[...].conf to 25_default_whitelist_[...].conf 
since whitelist needs to be defined before SUID removal commands
 2020-12-01 05:03:16 -05:00
Patrick Schleizer
36a471ebce
SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists 
`whitelists_disable_all=true`
 2020-12-01 05:02:34 -05:00
Patrick Schleizer
318ab570aa
simplify disabling of SUID Disabler and Permission Hardener whitelist 
split `/etc/permission-hardening.d/30_default.conf` into multiple files

`/etc/permission-hardening.d/40_default_whitelist_[...].conf`

therefore make it easier to delete any whitelisted SUID binaries
 2020-12-01 04:28:15 -05:00
Patrick Schleizer
cf07e977bd
add /bin/pkexec exactwhitelist for consistency 
since there is already `/usr/bin/pkexec exactwhitelist`
 2020-11-29 09:09:42 -05:00
Patrick Schleizer
938e929f39
add pkexec to suid default whitelist 
/usr/bin/pkexec exactwhitelist
/usr/bin/pkexec.security-misc-orig exactwhitelist
 2020-04-12 16:37:51 -04:00
Patrick Schleizer
2ceea8d1fe
update copyright year 2020-04-01 08:49:59 -04:00
Patrick Schleizer
f3ff32ddbb
Protect /bin/mount from 'chmod -x'. 
/bin/mount exactwhitelist
/usr/bin/mount exactwhitelist

Remove SUID from 'mount' but keep executable.

/bin/mount 745 root root
/usr/bin/mount 745 root root

https://forums.whonix.org/t/disable-suid-binaries/7706/61
 2019-12-30 06:39:24 -05:00
Patrick Schleizer
e5623fcd2b
comment 2019-12-29 04:21:52 -05:00
Patrick Schleizer
674840e6f9
/fusermount matchwhitelist 
unbreak AppImages such as electrum Bitcoin wallet

https://forums.whonix.org/t/disable-suid-binaries/7706/57
 2019-12-26 05:44:35 -05:00
madaidan
79241c5d09
Make /lib/modules unreadable 2019-12-23 20:28:29 +00:00
Patrick Schleizer
9d77d88a4d
comments 2019-12-23 09:39:50 -05:00
Patrick Schleizer
11b4192fbd
comments 2019-12-23 03:28:42 -05:00
Patrick Schleizer
2152fa2d61
comment 2019-12-23 02:38:53 -05:00
Patrick Schleizer
f8f2e6c704
fix disablewhitelist feature 2019-12-23 02:35:13 -05:00
Patrick Schleizer
47ddcad0c0
rename keyword whitelist to exactwhitelist 
add new keyword disablewhitelist

refactoring
 2019-12-23 02:29:47 -05:00
Patrick Schleizer
1ff56625a1
polkit-agent-helper-1 matchwhitelist to match both 
- /usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
- /lib/policykit-1/polkit-agent-helper-1
 2019-12-23 01:42:03 -05:00
Patrick Schleizer
d484b299ea
matchwhitelist /qubes/qfile-unpacker to match both 
- /usr/lib/qubes/qfile-unpacker whitelist
- /lib/qubes/qfile-unpacker
 2019-12-23 01:38:31 -05:00
Patrick Schleizer
58a4e0bc7d
dbus-daemon-launch-helper matchwhitelist 2019-12-22 19:12:10 -05:00
Patrick Schleizer
15e3a2832d
comment 2019-12-22 18:57:23 -05:00
Patrick Schleizer
6eb8fd257a
suid utempter/utempter matchwhitelist 
to cover both:

/usr/lib/x86_64-linux-gnu/utempter/utempter
/lib/x86_64-linux-gnu/utempter/utempter
 2019-12-22 18:56:36 -05:00
Patrick Schleizer
2ddf7b5db5
/lib/ nosuid 2019-12-21 14:06:51 -05:00
Patrick Schleizer
3ea587187e
no need to exclude xorg nosuid on Debian 
http://forums.whonix.org/t/permission-hardening/8655/25
 2019-12-21 06:53:07 -05:00
Patrick Schleizer
d220bb3bc4
suid /usr/lib/chromium/chrome-sandbox whitelist 2019-12-20 13:07:01 -05:00
Patrick Schleizer
77b3dd5d6b
comments 2019-12-20 13:02:33 -05:00
Patrick Schleizer
d7bd477e73
add "/usr/lib/xorg/Xorg.wrap whitelist" 
until this is researched

https://manpages.debian.org/buster/xserver-xorg-legacy/Xorg.wrap.1.en.html
https://lwn.net/Articles/590315/
 2019-12-20 12:59:27 -05:00
Patrick Schleizer
17e8605119
add matchwhitelist feature 
add "/usr/lib/virtualbox/ matchwhitelist"
 2019-12-20 12:57:24 -05:00
Patrick Schleizer
3fab387669
suid /usr/bin/firejail whitelist 
There is a controversy about firejail but those who choose to install it
should be able to use it.
https://www.whonix.org/wiki/Dev/Firejail#Security
 2019-12-20 12:50:35 -05:00
Patrick Schleizer
d3f16a5bf4
sgid /usr/lib/qubes/qfile-unpacker whitelist 2019-12-20 12:47:10 -05:00
Patrick Schleizer
508ec0c6fa
comment 2019-12-20 12:34:07 -05:00
Patrick Schleizer
1b569ea790
comment 2019-12-20 12:32:36 -05:00
Patrick Schleizer
e28da89253
/bin/sudo whitelist / /bin/bwrap whitelist 2019-12-20 09:48:06 -05:00
Patrick Schleizer
6d30e3b4a2
do not remove suid from whitelisted binaries ever 
https://forums.whonix.org/t/permission-hardening/8655/13
 2019-12-20 08:13:23 -05:00
Patrick Schleizer
48fe7312bf
update config 2019-12-20 05:57:41 -05:00
Patrick Schleizer
87d820d84c
comment 2019-12-20 05:54:16 -05:00
Patrick Schleizer
46466c12ad
parse drop-in config folder rather than only one config file 2019-12-20 05:49:11 -05:00